Manage repo blocklists with the Admin API

Team admins can keep sensitive files out of model context by listing repos and glob patterns on the repo-blocklists Admin API routes. Official reference: Admin API → Get / Upsert / Delete Team Repo Blocklists.

Authenticate with a team Admin API key (Basic auth, key as username, empty password).

List current blocklists

curl -X GET https://api.cursor.com/settings/repo-blocklists/repos \
  -u YOUR_API_KEY:

Example response:

{
  "repos": [
    {
      "id": "repo_123",
      "url": "https://github.com/company/sensitive-repo",
      "patterns": ["*.env", "config/*", "secrets/**"]
    },
    {
      "id": "repo_456",
      "url": "https://github.com/company/internal-tools",
      "patterns": ["*"]
    }
  ]
}

Upsert patterns for specific repos

POST /settings/repo-blocklists/repos/upsert replaces patterns only for the repos you send. Other repos stay untouched.

curl -X POST https://api.cursor.com/settings/repo-blocklists/repos/upsert \
  -u YOUR_API_KEY: \
  -H "Content-Type: application/json" \
  -d '{
    "repos": [
      {
        "url": "https://github.com/company/sensitive-repo",
        "patterns": ["*.env", "config/*", "secrets/**"]
      },
      {
        "url": "https://github.com/company/internal-tools",
        "patterns": ["*"]
      }
    ]
  }'

Pattern	Effect
*	Block the entire repository
*.env	Block all .env files
config/*	Block everything under config/
**/*.secret	Block .secret files in any subdirectory
src/api/keys.ts	Block one concrete file

Delete a repo from the blocklist

Use the encoded id from the list response. Success is 204 No Content.

curl -X DELETE https://api.cursor.com/settings/repo-blocklists/repos/repo_123 \
  -u YOUR_API_KEY:

Pitfalls

• Deleting by repo URL instead of the repo_… id from the list response.
• Expecting upsert to wipe the whole team blocklist — it only overwrites the repos in the request body.
• Using * when you meant a narrower glob — * blocks the entire repository as context.
• Forgetting audit coverage — related team repo changes can surface as team_repo events in audit logs.